Spyware.Spy4PC

Behavior
Spyware.Spy4PC is a spyware program that monitors user activity, logs keystrokes, and takes screenshots.

Symptoms
Your Symantec program detects Spyware.Spy4PC.

Transmission
Spyware.Spy4PC must be manually installed.

technical details
File names:
Spy4PCSetup.exe
msudp.dll
sfpc.exe
sfpcinfo.exe

When Spyware.Spy4PC is installed, it performs the following actions:

1. Creates the following files:

* %UserProfile%\Start Menu\Programs\SPY4PC\Spy4PC Info.lnk
* %UserProfile%\Start Menu\Programs\SPY4PC\Spy4PC.lnk
* %UserProfile%\Start Menu\Programs\SPY4PC\Uninstall Spy4PC.lnk
* %UserProfile%\Application Data\sfpc.dat
* %UserProfile%\Desktop\Spy4pc Info.lnk
* %ProgramFiles%\WinPcap\NetMonInstaller.exe
* %System%\gi44.tmp
* %System%\gi45.tmp
* %System%\gi46.tmp
* %System%\msipv6.dll
* %System%\msudp.dll
* %System%\pppoe32.dll
* %System%\sfpc.chm
* %System%\sfpc.dat
* %System%\sfpc.exe
* %System%\sfpcinfo.exe
* %System%\unins000.dat
* %System%\unins000.exe
* %System%\wanpacket.dll
* %System%\WinPcap_3_1_beta_3.exe

Notes:
* %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
* %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
* %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

2. Adds the value:

"sfpc" = "%System%\sfpc.exe"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the risk runs every time Windows starts.

3. Monitors user activity, logs keystrokes, and takes screenshots.

REMOVAL INSTRUCTIONS
See:http://securityresponse.symantec.com/avcenter/venc/data/spyware.spy4pc.html